# Can a TLS certificate using ECC secp384r1 as PK algorithm uses RSA for signature

If a TLS certificate public-key algorithm is ECC secp384r1 or ECC prime256v1, is it possible to have RSA as a signature algorithm? Or does it use ECDSA for signature? Or can it use any of them (ECDSA or RSA)?

• What Signature are you talking about? Signature by CA or Signature for ephemeral key exchange? (In the first case RFC4492 restricted the CA signature to ECDSA but that was removed in RFC5246. security.stackexchange.com/a/175753 – eckes Dec 17 '18 at 2:23

Previously RSA could also be used for session key establishment / authentication using encryption / decryption of the master secret value: the cipher suites starting with RSA_. That use has been deprecated in TLS 1.3, but it is certainly incompatible with EC certificates in versions earlier than TLS 1.2.
• So how do you explain a server's leaf cert. records that contains: ECC prime256v1 for certificate public-key algorithm, and sha256WithRSAEncryption for certificate-signature algorithm, and Digital Signature critical for certificate key uage? The ciphersuite is: TLS_AES_128_GCM_SHA256 and the TLS version is TLSv1.3. One possibility is that the certificate-signature algorithm (certSignatureAlg in OpenSSL terms) means the signature algorithm used by the CA who signed the server's cert. and not the server's cert's signature algorithm. Any idea? – user9371654 Dec 16 '18 at 19:12